CVE-2006-2447 - Secunia Advisories - Vulnerability Intelligence

CVE Reference: CVE-2006-2447
NOTE: The text on this page is written by CVE MITRE and reflects neither the opinions of Secunia or the results of our research. All data on this page is written and maintained by CVE MITRE.

Original Page at CVE MITRE: CVE-2006-2447

Description: SpamAssassin before 3.1.3, when running with vpopmail and the paranoid (-P) switch, allows remote attackers to execute arbitrary commands via a crafted message that is not properly handled when invoking spamd with the virtual pop username.

CVE Status: Candidate

References: XF http://xforce.iss.net/xforce/xfdb/27008 TRUSTIX http://www.trustix.org/errata/2006/0034/ ST 1016230 1016235 SAID Secunia Advisory: SA20443 Secunia Advisory: SA20430 Secunia Advisory: SA20482 Secunia Advisory: SA20531 Secunia Advisory: SA20566 Secunia Advisory: SA20692 REDHAT http://www.redhat.com/support/errata/RHSA-2006-0543.html MANDRIVA http://frontal2.mandriva.com/security/advisories?name=MDKSA-2006:103 GENTOO http://www.gentoo.org/security/en/glsa/glsa-200606-09.xml DEBIAN http://www.debian.org/security/2006/dsa-1090 CONFIRM http://www.nabble.com/ANNOUNCE%3A-Apache-SpamAssassin-3.1.3-available%21-t1736096.html BUGTRAQ http://www.securityfocus.com/archive/1/archive/1/436288/100/0/threaded BID 18290

Return to the previous page.